From 730ff6f55fe4019c699e764d84913362dafc795e Mon Sep 17 00:00:00 2001
From: Lari Taskula <lari.taskula@jns.fi>
Date: Thu, 13 Oct 2016 15:21:57 +0300
Subject: [PATCH] [SIGNED-OFF] Bug 17006: (follow-up) Let librarians change
 patron's passwords

This should obviously be part of this feature but was left unnoticed in the
first patch. If user has "borrowers"-flag, they should be able to change patron's
password without providing old password.

To test:
1. Run t/db_dependent/api/v1/patrons.t
2. Observe failing test
3. Apply patch
4. Run t/db_dependent/api/v1/patrons.t
5. Observe passing test
6. Send PATCH request to http://library/api/v1/patrons/YYY/password
   where YYY is existing borrowernumber (borrowers flag required)
   and where YYY is not the same borrowernumber as your logged-in
   user's borrowernumber
7. Make sure that password was changed for YYY.

You may find this useful for testing:

curl -X PATCH http://library/api/v1/patrons/123/password \
     --data '{"new_password":"1234"}' \
     --cookie 'CGISESSID=055ca5a9a3ad3fb5052143bd015c1c10'

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
---
 Koha/REST/V1/Patron.pm | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Koha/REST/V1/Patron.pm b/Koha/REST/V1/Patron.pm
index 2660e7f..2f5c0a9 100644
--- a/Koha/REST/V1/Patron.pm
+++ b/Koha/REST/V1/Patron.pm
@@ -53,21 +53,21 @@ sub changepassword {
     my $patron = Koha::Patrons->find($args->{borrowernumber});
 
     my $OpacPasswordChange = C4::Context->preference("OpacPasswordChange");
-    unless ( $user
-        && ( ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber})
-            || haspermission($user->userid, {borrowers => 1}) ) )
-    {
+    my $haspermission = haspermission($user->userid, {borrowers => 1});
+    unless ($OpacPasswordChange && $user->borrowernumber == $args->{borrowernumber}
+            || $haspermission) {
         return $c->$cb({ error => "OPAC password change is disabled" }, 403);
     }
     return $c->$cb({ error => "Patron not found." }, 404) unless $patron;
 
     my $pw = $args->{'body'};
     my $dbh = C4::Context->dbh;
-    unless (checkpw_internal($dbh, $user->userid, $pw->{'current_password'})) {
+    unless ($haspermission
+            || checkpw_internal($dbh, $patron->userid, $pw->{'current_password'})) {
         return $c->$cb({ error => "Wrong current password." }, 400);
     }
 
-    my ($success, $errmsg) = $user->change_password_to($pw->{'new_password'});
+    my ($success, $errmsg) = $patron->change_password_to($pw->{'new_password'});
     if ($errmsg) {
         return $c->$cb({ error => $errmsg }, 400);
     }
-- 
2.1.4